IP addresses [IPv4]

This API is similar with the IP addresses [FLAT] however have some advantages and disadvantages in respect:

  1. Real time calculation of the OneFirewall Crime Score
  2. Equipped with the new (v3.2) Scoring algorithm
  3. Can be integrated into directly Fortigate, Checkpoint, etc..
  1. Use pagination (therefore you have to call multiple times the IP if the list is bigger than 10000)
  2. Is relativly 6x slower than IP addresses [FLAT]

GET Flat list of IPv4

You can call the API /api/v1/ipv4/:min_score?format=csv in order to receive a plain text list (CSV) of IPv4 based on Min Score.

HTTP Request

GET /api/v1/ipv4/:min_score?format=CSV&page=BASE64String HTTP/1.1
Host: app.onefirewall.com
Authorization: Bearer PLACE_YOUR_OWN_TOKEN_HERE
Variable Possible Values Notes
min_score 1 to 1000 (Integer) Minimum WCF Crime Score Feeds
format CSV or LIST (String) CSV=the output is CSV, LIST=the output is a list of IPs separated by ‘,’
agid String Agent ID (Mandatory for Feeds accessible without WCF Agent)
plugin String Plugin Name (Mandatory for Feeds accessible without WCF Agent)
page String A cursor that indicates the next page ID to access the next batch of data

If the response header contains a variable with name next_page, use the value with the new request on the API in order to retreive the next batch of data for the same Score. If the header is not presented, means there no more data to return.


The possible HTTP Code responses are:

  • 200 OK: The request was received and processed successfully
  • 400 Bad Request: The request was malformed (body contains further explanations)
  • 401 Unauthorized: The request not authorized (body contains further explanations)
  • 402 Payment Required: Not enogh OneFirewall Coins to perform the request
  • 5XX Internal Server Error: The service is momentarily unavailable

In case of an 200 response the body will be presented as the below examples:

CSV (in case format=CSV or not presented in the request)
LIST (in case format=LIST)